{"id":"CVE-2026-29013","summary":"libcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling","details":"libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.","modified":"2026-07-15T15:56:19.772468Z","published":"2026-04-17T21:11:38.137Z","related":["openSUSE-SU-2026:10592-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29013.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29013.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29013"},{"type":"FIX","url":"https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/obgm/libcoap","events":[{"introduced":"0"},{"fixed":"851533c3cf63d16984d370ce39d586ecb3694971"},{"fixed":"b7847c4dbb0dbee7c90b09a673d4cae256f03718"}],"database_specific":{"cpe":"cpe:2.3:a:libcoap:libcoap:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.3.5b"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v4.3.5a","v4.3.5","v4.3.5-rc3","v4.3.5-rc2","v4.3.5-rc1","v4.3.4","v4.3.3","v4.3.2","v4.3.2-rc2","v4.3.2-rc1","v4.2.1","v4.2.0","v4.2.0-rc4","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.2","v4_1_1","v4.1.1","coap-lwip"],"database_specific":{"vanir_signatures_modified":"2026-07-15T15:56:19Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"85326049542284814399856562787741768727","length":1292},"id":"CVE-2026-29013-14a69ac7","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c","function":"coap_dtls_send"}},{"digest":{"function_hash":"234449401030151093557016170936013345272","length":1104},"id":"CVE-2026-29013-199ef1ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718","target":{"file":"src/coap_pdu.c","function":"coap_pdu_resize"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718","target":{"file":"src/coap_pdu.c","function":"coap_insert_option"},"deprecated":false,"digest":{"function_hash":"163139666809267205907934828302033055773","length":1898},"id":"CVE-2026-29013-21369a8c","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c","function":"coap_tls_write"},"deprecated":false,"digest":{"function_hash":"306736978701644454561638712225277067477","length":2188},"id":"CVE-2026-29013-261a61fc","signature_type":"Function"},{"id":"CVE-2026-29013-2f0a44ef","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718","target":{"file":"src/coap_cache.c","function":"coap_new_cache_entry_lkd"},"deprecated":false,"digest":{"function_hash":"269345429273585233355993168588472588375","length":1230}},{"target":{"file":"src/coap_wolfssl.c"},"deprecated":false,"digest":{"line_hashes":["15411908909958860775211265335536427407","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","116849850931191068750177515966678256220","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620"],"threshold":0.9},"id":"CVE-2026-29013-33d6c428","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"deprecated":false,"digest":{"line_hashes":["337904441687869165843535038722711579335","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","106183898905765163754583739743222052929","170919558706517679028022730513223874599","116386489271052775311612969382955059435","282613876025531397485030245403164080916","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792"],"threshold":0.9},"id":"CVE-2026-29013-34f6744f","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c"}},{"target":{"file":"src/coap_gnutls.c","function":"coap_dtls_send"},"deprecated":false,"digest":{"function_hash":"91326830784992737475680710694707116123","length":1214},"id":"CVE-2026-29013-45242826","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c","function":"coap_tls_read"},"deprecated":false,"digest":{"function_hash":"26430849427469556451136376777718145170","length":2347},"id":"CVE-2026-29013-490458a7","signature_type":"Function"},{"id":"CVE-2026-29013-4cf2dc64","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_tinydtls.c"},"deprecated":false,"digest":{"line_hashes":["23031380702055205930316498110125306054","34378583416927325614830432188681466307","279146812373370674349054110943019686116","171625597872910728004536992034728778681","312943919646741470530525044446109984842","332522464106056864701340573670213419036","45989790058782624768189185181864209162","98058673563965097939786667199771668346","39696012473944314118650810272553802704","246188265563190334208842778449331505997","70970862817180733918113699814896602943","279146812373370674349054110943019686116","132753285705974266946915529153894719367","216141987605081778056913603438184117426"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718","target":{"file":"src/coap_cache.c"},"deprecated":false,"digest":{"line_hashes":["41077806422651470997407907423359996154","334547532809716863844984897270055029098","48310381508498004817858943609588897259","321985207314050649042684072977655416369"],"threshold":0.9},"id":"CVE-2026-29013-548620f1"},{"id":"CVE-2026-29013-6835ef5b","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718","target":{"file":"src/coap_pdu.c"},"deprecated":false,"digest":{"line_hashes":["25760512086781370292305404490306046537","284700227472468015546206785840876704821","165746102564872814049741092259811228873","314667520170926084001166847650699849238","34090471563950301366864168382163415797","296360447884279457991624814003963274538","143297195253141984427092693838958340601","208365782059928000621169018308790142921","139057133950717645175067910716636525721","67276321665009667864727040075051726187","201802454877392084188736737237099871697","97737421856580511813397849277758791990","276154561835686747240532382512064464872","39237509026890483944241448714185344067","292495016775632168709621965482125159728","169363759592041428992117775613195416898","248878460037729922988672902909026392737","143072617565515576905719910809919267007"],"threshold":0.9}},{"target":{"file":"src/coap_gnutls.c","function":"coap_tls_write"},"deprecated":false,"digest":{"function_hash":"292531550078019844896041999038719597629","length":1644},"id":"CVE-2026-29013-706c0010","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_gnutls.c","function":"coap_tls_read"},"deprecated":false,"digest":{"function_hash":"21776863930825372101923181712764214740","length":1691},"id":"CVE-2026-29013-712f2490","signature_type":"Function"},{"source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c","function":"coap_tls_read"},"deprecated":false,"digest":{"function_hash":"123123615217698491116894614054529509886","length":1721},"id":"CVE-2026-29013-8032e978","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"243687100477660245376362105986385717485","length":1144},"id":"CVE-2026-29013-83b56253","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_tinydtls.c","function":"coap_dtls_receive"}},{"deprecated":false,"digest":{"length":2908,"function_hash":"212547978384719786255233504667115321999"},"id":"CVE-2026-29013-92d9e275","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c","function":"coap_dtls_receive"}},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_tls_write"},"deprecated":false,"digest":{"function_hash":"69576481631951111685028577390359454494","length":2314},"id":"CVE-2026-29013-96c2892b","signature_type":"Function"},{"source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_dtls_send"},"deprecated":false,"digest":{"function_hash":"33563004650523345432675580502379313629","length":1429},"id":"CVE-2026-29013-9a254090","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-29013-aeaf7c79","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_gnutls.c","function":"coap_dtls_receive"},"deprecated":false,"digest":{"function_hash":"62577777721189041801822773906509644626","length":2180}},{"deprecated":false,"digest":{"function_hash":"53159726183479920923849338954582782305","length":1268},"id":"CVE-2026-29013-b3cc0b6f","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_tinydtls.c","function":"coap_dtls_send"}},{"id":"CVE-2026-29013-b6e4875f","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_dgram_destroy"},"deprecated":false,"digest":{"function_hash":"332227376013851657869784690061081720703","length":205}},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c"},"deprecated":false,"digest":{"line_hashes":["228786392259244641228734032934904780662","147523157495900877670261885925168230258","274004364396085238039277557504504360751","243584047675722518274780453976884872415","316713216995309952059170077154033832999","320611148643336054835590721458452056095","302011017503512693175439017717461116647","292891296865426260604046022276368703977","230625849031722816986402087332575496535","284678711105798280628671396721516681294","323488070396003554448137350098952839075","15411908909958860775211265335536427407","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","246891808803424668580015653032779311636","112987783015174694802545845404680311345","40564534837348066573672403462459524202","129737476834047468114495478589610197958","157315502960125796006743010604178644195","93273170937260253080487266157097258389","318568369596440574502441282311675373682","54887952225474782336202312518365773955","327813439605604673563040909498457788576","105168350939195450450982919117347968160","220268690295836453743650173385787328342","224345847398824450692939426554678706137","37315100012202224297509390738082288814","115133386853268709054882557872202831658","300974842540064882699480831770012553051","116849850931191068750177515966678256220","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","45119872330899513837839042929631692459","124698168619203789640236191387417845590","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856"],"threshold":0.9},"id":"CVE-2026-29013-b8eb784b","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"250611704829397383855490180259296588716","length":2651},"id":"CVE-2026-29013-c112c914","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_dtls_receive"}},{"deprecated":false,"digest":{"function_hash":"15776374160949478909324118090219155812","length":2194},"id":"CVE-2026-29013-c34a6555","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_tls_read"}},{"target":{"file":"src/coap_mbedtls.c","function":"coap_dtls_receive"},"deprecated":false,"digest":{"function_hash":"236662025558247763740982530323169619238","length":2134},"id":"CVE-2026-29013-c3de0290","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"digest":{"function_hash":"277881577929113743393994050608192386535","length":1069},"id":"CVE-2026-29013-d91579f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"function":"coap_dtls_send","file":"src/coap_wolfssl.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792"],"threshold":0.9},"id":"CVE-2026-29013-eea6ea75","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_gnutls.c"}},{"target":{"file":"src/coap_mbedtls.c","function":"coap_tls_write"},"deprecated":false,"digest":{"length":1699,"function_hash":"24544517956092318288850958517713751891"},"id":"CVE-2026-29013-f6da2924","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29013.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N"}]}